admin_data 1.1.3 → 1.1.4

data/Rakefile

@@ -31,7 +31,7 @@ begin
     s.email = "neerajdotname@gmail.com"
     s.homepage = "http://github.com/neerajdotname/admin_data"
     s.authors = ['Neeraj Singh']
-    s.files = FileList["[A-Z]*", "{app,config,lib,public}/**/*", 'init.rb']
+    s.files = FileList["[A-Z]*", "{app,config,lib}/**/*", 'init.rb']
 
     s.add_dependency('will_paginate', '>= 3.0.pre2')
 

data/app/controllers/admin_data/public_controller.rb

@@ -2,15 +2,13 @@ module AdminData
   class PublicController < ApplicationController
 
     def serve
-      path = File.join(AdminData.public_dir,params[:file])
-      expanded_path = File.expand_path(path)
 
-      # validate that expanded path has admin_data
-      unless expanded_path =~ /admin_data/
+      # validate filename with a white list
+      unless self.class.admin_data_assets.include? params[:file]
         render :nothing => true, :status => 404 and return
       end
 
-      opts = {:text => File.read(path), :cache => true}
+      opts = {:text => File.read(File.join(AdminData.public_dir,params[:file])), :cache => true}
 
       case params[:file]
       when /\.css$/i then opts[:content_type] = "text/css"
@@ -23,6 +21,17 @@ module AdminData
       render opts
     end
 
+    protected
 
+    # Cached list of all assets provided by admin_data
+    # It is used to ensure security in the serve method
+    def self.admin_data_assets
+      @admin_data_assets ||= (
+        Dir.glob(File.join(AdminData.public_dir, '**', '*')).map do |path|
+           # we want only relative paths
+           path.split(AdminData.public_dir, 2).last
+        end
+      )
+    end
   end
 end

data/lib/admin_data/version.rb

@@ -1,3 +1,3 @@
 module AdminData
-  VERSION = '1.1.3'
+  VERSION = '1.1.4'
 end

data/lib/admin_data.rb

@@ -9,7 +9,7 @@ module AdminData
   end
 
   def self.public_dir
-    File.expand_path(File.join(LIBPATH, 'public')) + File::SEPARATOR
+    File.expand_path(File.join(LIBPATH, '..', 'public')) + File::SEPARATOR
   end
 
   class << self

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification 
 name: admin_data
 version: !ruby/object:Gem::Version 
-  hash: 21
+  hash: 27
   prerelease: false
   segments: 
   - 1
   - 1
-  - 3
-  version: 1.1.3
+  - 4
+  version: 1.1.4
 platform: ruby
 authors: 
 - Neeraj Singh
@@ -160,35 +160,6 @@ files:
 - lib/admin_data/util.rb
 - lib/admin_data/version.rb
 - lib/admin_data_date_validation.rb
-- lib/public/images/add.png
-- lib/public/images/no.png
-- lib/public/images/site.png
-- lib/public/javascripts/advance_search/act_on_result.js
-- lib/public/javascripts/advance_search/advance_search.js
-- lib/public/javascripts/advance_search/advance_search_structure.js
-- lib/public/javascripts/advance_search/ajaxify_advance_search.js
-- lib/public/javascripts/advance_search/build_first_row.js
-- lib/public/javascripts/advance_search/event_bindings.js
-- lib/public/javascripts/advance_search/global_ajax_setting.js
-- lib/public/javascripts/advance_search/trigger_submit_on_domready.js
-- lib/public/javascripts/misc/drop_down_change.js
-- lib/public/javascripts/misc/js_util.js
-- lib/public/javascripts/misc/quick_search_input_focus.js
-- lib/public/javascripts/test/act_on_result.js
-- lib/public/javascripts/test/advance_search.js
-- lib/public/javascripts/test/ajaxify_advance_search.js
-- lib/public/javascripts/test/build_first_row.js
-- lib/public/javascripts/test/event_bindings.js
-- lib/public/javascripts/vendor/jack.js
-- lib/public/javascripts/vendor/jquery-1.4.2.js
-- lib/public/javascripts/vendor/jquery-ui-1.7.2.custom.min.js
-- lib/public/javascripts/vendor/jquery.ba-isjquery.js
-- lib/public/javascripts/vendor/jquery_form.js
-- lib/public/javascripts/vendor/log.js
-- lib/public/javascripts/vendor/qunit.js
-- lib/public/javascripts/vendor/rails.js
-- lib/public/stylesheets/base.css
-- lib/public/stylesheets/vendor/jquery-ui-1.7.2.custom.css
 - test/rails_root/app/controllers/application_controller.rb
 - test/rails_root/app/helpers/application_helper.rb
 - test/rails_root/app/models/city.rb

data/lib/public/javascripts/advance_search/act_on_result.js

@@ -1,45 +0,0 @@
-var AdminData = AdminData || {};
-
-AdminData.actOnResult = {
-
-	action: function(action_type) {
-		var formData = $('#advance_search_form').data('admin_data_form_array'),
-		parameterizedData;
-
-		formData.push({
-			'name': 'admin_data_advance_search_action_type',
-			'value': action_type
-		});
-
-		parameterizedData = $.param(formData);
-
-		$.ajax({
-			url: $('#advance_search_form').attr('action'),
-			type: 'post',
-			dataType: 'json',
-			data: parameterizedData,
-			success: function(json) {
-				AdminData.actOnResult.successCallback(json);
-			}
-		});
-	},
-
-	successCallback: function(json) {
-		$('#results').text(json.success);
-	}
-
-};
-
-$('#advance_search_delete_all').live('click', function() {
-	if (window.confirm('Are you sure?')) {
-		AdminData.actOnResult.action('delete');
-	}
-	return false;
-});
-
-$('#advance_search_destroy_all').live('click', function() {
-	if (window.confirm('Are you sure?')) {
-		AdminData.actOnResult.action('destroy');
-	}
-	return false;
-});

data/lib/public/javascripts/advance_search/advance_search.js

@@ -1,83 +0,0 @@
-var AdminData = AdminData || {};
-
-AdminData.advanceSearch = {
-
-	buildFirstRow: function() {
-
-		var img = $('<img />', {
-			src: '/admin_data/public/images/add.png'
-		});
-
-		$('#advance_search_table').append(this.buildRow())
-                                .find('tr td:last a')
-                                .attr('id','add_row_link_1')
-                                .removeClass('remove_row')
-                                .addClass('add_row_link')
-                                .html('')
-                                .append(img);
-	},
-
-	buildCol1: function() {
-		var i, col = $('<select />', { className: 'col1' }).append($('<option />')),
-		tableStructure = $('#advance_search_table').data('table_structure');
-
-		for (i in tableStructure) {
-			$('<option />', {
-				text: i,
-				value: i
-			}).appendTo(col);
-		}
-		return $('<td />').append(col);
-	},
-
-	buildCol2: function() {
-		var select = $('<select />', { className: 'col2', disabled: 'disabled' });
-		return $('<td />').append(select);
-	},
-
-	buildCol3: function() {
-		var select = $('<input />', { className: 'col3' });
-		return $('<td />').append($('<input />', { className: 'col3', disabled: 'disabled' }));
-	},
-
-	buildCol4: function() {
-		var img = $('<img />', {
-			src: '/admin_data/public/images/no.png'
-		});
-
-		return $('<td />').append($('<a />', {
-			text: '',
-			href: '#',
-			className: 'remove_row'
-		}).append(img));
-	},
-
-	buildRow: function() {
-
-		var $tr = $('<tr />'),
-		currentRowNumber = $(document).data('currentRowNumber'),
-		that = this,
-		build_array = ['buildCol1', 'buildCol2', 'buildCol3', 'buildCol4'];
-
-		if (currentRowNumber === undefined) {
-			currentRowNumber = 1;
-			$(document).data('currentRowNumber', currentRowNumber);
-		} else {
-			currentRowNumber = parseInt(currentRowNumber, 10) + 1;
-			$(document).data('currentRowNumber', currentRowNumber);
-		}
-
-		$.each(build_array, function(index, value) {
-			$tr.append(that[value]());
-		});
-
-		$tr.find('select.col1').attr({ name: 'adv_search[' + currentRowNumber + '_row][col1]' });
-		$tr.find('select.col2').attr({ name: 'adv_search[' + currentRowNumber + '_row][col2]' });
-		$tr.find('input.col3').attr({ name: 'adv_search[' + currentRowNumber + '_row][col3]' });
-
-    $tr.find('.remove_row').attr('id', 'remove_row_'+currentRowNumber);
-
-		return $tr;
-	}
-
-};

data/lib/public/javascripts/advance_search/advance_search_structure.js

@@ -1,79 +0,0 @@
-AdminData = AdminData || {};
-
-AdminData.mappings =  {
-
-      //JSLint complains if a hash has key named boolean. So I am changing the key to booleant  
-      booleant: {
-        options: [  
-          ["is null",     "is_null"], 
-          ["is not null", "is_not_null"], 
-          ["is true",     "is_true"], 
-          ["is false",    "is_false"]
-        ]
-      },
-
-      string: {
-        options: [  
-          ["is null",         "is_null"], 
-          ["is not null",     "is_not_null"], 
-          ["contains",        "contains"], 
-          ["is exactly",      "is_exactly"], 
-          ["doesn't contain", "does_not_contain"]
-        ]
-      },
-
-      text: {
-        options: [  
-          ["is null",         "is_null"], 
-          ["is not null",     "is_not_null"], 
-          ["Contains",        "contains"], 
-          ["Doesn't Contain", "does_not_contain"]
-        ]
-      },
-
-      datetime: {
-        options: [  
-          ["is null",       "is_null"], 
-          ["is not null",   "is_not_null"],
-          ['on',            "is_on"], 
-          ['on or before',  "is_on_or_before_date"], 
-          ['on or after',   "is_on_or_after_date"]
-        ]
-      },
-
-      date: {
-        options: [  
-          ["is null",       "is_null"], 
-          ["is not null",   "is_not_null"],
-          ['on',            "is_on"], 
-          ['on or before',  "is_on_or_before_date"], 
-          ['on or after',   "is_on_or_after_date"]
-        ]
-      },
-
-      time: {
-        options: [  
-          ["is null",       "is_null"], 
-          ["is not null",   "is_not_null"],
-          ["is exactly",    "is_exactly"]
-        ]
-      },
-
-      decimal: {
-        options: [  
-          ['is equal to',     "is_equal_to"], 
-          ['is less than',    "less_than"], 
-          ['is greater than', "greater_than"]
-        ]
-      },
-
-      integer: {
-        options: [  
-          ['is equal to',     "is_equal_to"], 
-          ['is less than',    "less_than"], 
-          ['is greater than', "greater_than"]
-        ]
-      }
-};
-
-

data/lib/public/javascripts/advance_search/ajaxify_advance_search.js

@@ -1,28 +0,0 @@
-var AdminData = AdminData || {};
-
-AdminData.ajaxifyAdvanceSearch = {
-	successCallback: function(responseText) {
-		$('#results').html(responseText);
-	},
-
-	beforeSubmitCallback: function(formArray, jqForm) {
-		$('#results').html('<span class="searching_message">searching...</span>');
-		$('#advance_search_form').data('admin_data_form_array', formArray);
-	}
-};
-
-$(function() {
-
-	var options = {
-		success: function(responseText) {
-			AdminData.ajaxifyAdvanceSearch.successCallback(responseText);
-		},
-		beforeSubmit: function(formArray, jqForm) {
-			AdminData.ajaxifyAdvanceSearch.beforeSubmitCallback(formArray, jqForm);
-		}
-	};
-
-	$('#advance_search_form').ajaxForm(options);
-
-});
-

data/lib/public/javascripts/advance_search/build_first_row.js

@@ -1,8 +0,0 @@
-$(function() {
-
-  var json = $.parseJSON( $('#primary_column_type_info').html());
-	$('#advance_search_table').data('table_structure', json);
-	AdminData.advanceSearch.buildFirstRow();
-
-});
-

data/lib/public/javascripts/advance_search/event_bindings.js

@@ -1,76 +0,0 @@
-var AdminData = AdminData || {};
-
-AdminData.bindings = {
-
-	col2_change: function(e) {
-		var arrayList = ['is_false', 'is_true', 'is_null', 'is_not_null'],
-		$col2 = $(e.target).closest('select'),
-		value = $col2.val(),
-		tableStructure = $('#advance_search_table').data('table_structure'),
-		$col3 = $col2.parents('tr').find('td input.col3'),
-		$col1 = $col2.parents('tr').find('td select.col1'),
-		col1ColumnType = tableStructure[$col1.val()];
-
-
-		if (value.length === 0 || ($.inArray(value, arrayList) > - 1)) {
-			 $col3.val('').attr('disabled','disabled');
-
-		} else {
-      $col3.removeAttr('disabled');
-			if (col1ColumnType === 'datetime' || col1ColumnType === 'date') {
-				$col3.val(AdminData.jsUtil.dateToString(new Date())).addClass('datepicker');
-				
-        $('.datepicker').datepicker({ dateFormat: 'dd-MM-yy', changeYear: true, changeMonth: true });
-
-			} else {
-				$('.datepicker').datepicker('destroy');
-				$col3.removeClass('datepicker').focus(); // do not create focus for date pickers
-			}
-		}
-	},
-
-	pagination_click: function(e) {
-		var href = $(e.target).closest('a').attr('href');
-
-    $.ajax({ url: href, dataType: "text", success: function(responseText){
-      $('#results').html(responseText);
-    }});
-    
-		AdminData.jsUtil.colorizeRows();
-	},
-
-	col1_change: function(e) {
-		var col1 = $(e.target).closest('select'),
-		tableStructure = $('#advance_search_table').data('table_structure'),
-		columnType = tableStructure[col1.val()],
-		options = AdminData.mappings[columnType]['options'],
-		col2 = col1.parents('tr').find('td select.col2');
-
-		col2.html('');
-		AdminData.jsUtil.buildOptionsFromArray(options, col2);
-		col2.trigger('change').removeAttr('disabled');
-	}
-};
-
-$('.pagination a').live('click', function(e) {
-	AdminData.bindings.pagination_click(e);
-	return false;
-});
-
-$('#advance_search_table a.add_row_link').live('click', function() {
-	$('#advance_search_table').append(AdminData.advanceSearch.buildRow());
-	return false;
-});
-
-$('#advance_search_table a.remove_row').live('click', function(e) {
-	$(e.target).closest('tr').remove();
-	return false;
-});
-
-$('#advance_search_table select.col1').live('change', function(e) {
-	AdminData.bindings.col1_change(e);
-});
-
-$('#advance_search_table select.col2').live('change', function(e) {
-	AdminData.bindings.col2_change(e);
-});

data/lib/public/javascripts/advance_search/global_ajax_setting.js

@@ -1,10 +0,0 @@
-$(function() {
-
-	$.ajaxSetup({
-		'beforeSend': function(xhr) {
-			xhr.setRequestHeader("Accept", "text/javascript");
-		}
-	});
-
-});
-

data/lib/public/javascripts/advance_search/trigger_submit_on_domready.js

@@ -1,6 +0,0 @@
-$(function() {
-
-	$('#advance_search_form').trigger('submit');
-
-});
-

data/lib/public/javascripts/misc/drop_down_change.js

@@ -1,8 +0,0 @@
-$(function() {
-
-	$('.drop_down_value_klass').change(function() {
-		window.location = $(this).val();
-	});
-
-});
-

data/lib/public/javascripts/misc/js_util.js

@@ -1,58 +0,0 @@
-var AdminData = AdminData || {};
-
-/**
- * A general Utility
- * @namespace AdminData
- * @class jsUtil
- */
-AdminData.jsUtil = {
-
-  // TODO since advance search was not working with util confirm , window.confirm is used directly
-  // fix it later
-	confirm: function(arg) {
-		window.confirm(arg);
-	},
-
-	buildOptionsFromArray: function(array, element) {
-		element.append($('<option />'));
-		for (i in array) {
-			$('<option />').text(array[i][0]).attr('value', array[i][1]).appendTo(element);
-		}
-		element.attr('disabled', false);
-	},
-
-	colorizeRows: function() {
-		$('.colorize tr:odd').addClass('odd');
-		$('.colorize tr:even').addClass('even');
-	},
-
-  /**
-   * Returns the input date in string format.
-   *
-   * @param {date} input date 
-   * @return {string} The string value of input date
-   */
-	dateToString: function(date) {
-		var month = (date.getMonth() + 1).toString();
-		var day = date.getDate().toString();
-		//days between 1 and 9 should have 0 before them
-		if (day.length == 1) day = '0' + day;
-		var months = ['January', 'February', 'March', 'April', 'May', 'June', 'July', 'August', 'September', 'October', 'November', 'December'];
-		return day + "-" + months[month - 1] + "-" + date.getFullYear();
-	},
-
-  /**
-   * Generate a random number between 1 and 10000000
-   *
-   * @return {Integer} a random Integer
-   *
-   */
-	randomNumber: function() {
-		var maxVal = 100000000,
-		minVal = 1;
-		var randVal = minVal + (Math.random() * (maxVal - minVal));
-		return Math.round(randVal);
-	}
-
-};
-

data/lib/public/javascripts/misc/quick_search_input_focus.js

@@ -1,6 +0,0 @@
-$(function() {
-
-	$('#quick_search_input').focus();
-
-});
-

data/lib/public/javascripts/test/act_on_result.js

@@ -1,120 +0,0 @@
-module('act_on_result', {
-	teardown: function() {
-		$('#advance_search_delete_all').remove();
-		$('#advance_search_destroy_all').remove();
-		$('#results').remove();
-		$('#advance_search_form').remove();
-	},
-	setup: function() {
-		$(document.body).append($('<a />', {
-			href: '#',
-			id: 'advance_search_delete_all'
-		}));
-
-		$(document.body).append($('<a />', {
-			href: '#',
-			id: 'advance_search_destroy_all'
-		}));
-
-		$(document.body).append($('<div />', {
-			id: 'results'
-		}));
-
-		$(document.body).append($('<div />', {
-			id: 'advance_search_form'
-		}));
-	}
-});
-
-test('invoking success callback', function() {
-	expect(1);
-	AdminData.actOnResult.successCallback({
-		success: 'hello world'
-	});
-	equals('hello world', $('#results').text(), '#results should have text hello world');
-});
-
-test('live clicking #advance_search_delete_all with cancel action', function() {
-	expect(0);
-	jack(function() {
-		jack.expect('AdminData.jsUtil.confirm').once().mock(function() {
-			return false;
-		});
-		//TODO ensure that the value passed to action is delete
-		jack.expect('AdminData.actOnResult.action').exactly('0 time');
-		$('#advance_search_delete_all').trigger('click');
-	});
-});
-
-test('live clicking #advance_search_delete_all', function() {
-	expect(0);
-	var args;
-
-	jack(function() {
-		jack.expect('AdminData.jsUtil.confirm').once().mock(function() {
-			return true;
-		});
-		jack.expect('AdminData.actOnResult.action').once().mock(function(action_type) {
-			args = action_type;
-			return {};
-		});
-		$('#advance_search_delete_all').trigger('click');
-	});
-  equals('delete', args, 'action_type should be delete');
-
-});
-
-test('live clicking #advance_search_destroy_all with cancel action', function() {
-	expect(0);
-	jack(function() {
-		jack.expect('AdminData.jsUtil.confirm').once().mock(function() {
-			return false;
-		});
-		jack.expect('AdminData.actOnResult.action').exactly('0 time');
-		$('#advance_search_destroy_all').trigger('click');
-	});
-});
-
-test('live clicking #advance_search_destroy_all', function() {
-	expect(0);
-	var args;
-
-	jack(function() {
-		jack.expect('AdminData.jsUtil.confirm').once().mock(function() {
-			return true;
-		});
-		jack.expect('AdminData.actOnResult.action').once().mock(function(action_type) {
-			args = action_type;
-			return {};
-		});
-		$('#advance_search_destroy_all').trigger('click');
-	});
-	equals('destroy', args, 'action_type should be destroy');
-});
-
-test('actOnResultAJAX', function() {
-	expect(5);
-	$('#advance_search_form').attr('action', 'http://localhost:3000');
-	$('#advance_search_form').data('admin_data_form_array', [{
-		name: 'foo',
-		value: 'i_am_foo'
-	}]);
-
-	var ajaxArgs;
-
-	jack(function() {
-		jack.expect('$.ajax').once().mock(function(args) {
-			ajaxArgs = args;
-		});
-		AdminData.actOnResult.action('delete');
-	});
-
-	equals('post', ajaxArgs.type, 'ajax arguments should have type as post');
-	equals('json', ajaxArgs.dataType, 'ajax arguments should have json as dataType');
-	equals('http://localhost:3000', ajaxArgs.url, 'ajax arguments should have valid url');
-	var data = ajaxArgs.data;
-	ok(data, 'ajax arguments should have value for key data');
-	equals('foo=i_am_foo&admin_data_advance_search_action_type=delete', data, 'data should have parameterized value');
-
-});
-